Splunk Enterprise

How do I find a number of non-null values and put them in a column?

mistydennis
Communicator

I have a search that pulls values for 5 fields, some of which have a value and some that are null. I would like to create a new column ("totalrev") that counts the number of non-null values.

| inputlookup foo 
| search  field1=* OR field2=* OR field3=* OR field4=* OR field5=* 
| table field1, field2, field3, field4, field5, totalrev

How do I get a number into the "totalrev" column that will count the number of non-null values found in fields 1 - 5?

Tags (1)
0 Karma
1 Solution

tomawest
Path Finder

I think you would get it using the following statement above your table

eval totalrev=mvcount(mvappend(field1,field2,field3,field4,field5))

View solution in original post

tomawest
Path Finder

I think you would get it using the following statement above your table

eval totalrev=mvcount(mvappend(field1,field2,field3,field4,field5))

mistydennis
Communicator

Yes! That's what I needed - thank you so much!

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...